Optional public visitor measurement · updated 9 November 2026
Public pages offer a separate, optional visitor measurement choice. Allowing it creates bd_visits, a secure first-party cookie valid for up to 24 hours; its random identifier resets each UTC day. We record page categories, broad search/social/direct/other referral categories, mobile/desktop screen category and date, without full referrer URLs, query strings, names or account IDs. We respect browser Do Not Track and Global Privacy Control signals.
Your choice is remembered in bd-visitor-consent local storage until you change it or clear site data. Use Visitor privacy preferences in the public-page footer to withdraw: collection stops and records for the current daily identifier are removed. Earlier daily identifiers cannot be linked from that cookie and expire under the 90-day collection/report cleanup. A separate keyed hash of the connection address is used for short-lived abuse limits; raw addresses are not saved in measurement records. Account-linked feature measurement remains separately controlled in Data & preferences.
Our role and your organisation’s role
Chronicle Atlas Ltd is the controller for our own account administration, enquiries, billing, service security and optional product measurement. For personal information processed in a customer’s Business Desk on its documented instructions, we act as processor under the Data Processing Agreement. If your employer controls that workspace, it is normally responsible for the purposes, lawful basis and privacy information for that use. We assist it with requests.
The service is intended for adults. Do not supply children’s information, special-category or criminal-offence data, privileged client files, identification documents, passwords or individual payment-card details. Use aggregate business figures wherever possible.
Information we handle and where it comes from
- Accounts and access: name where supplied, verified email, account identifier, authentication sessions, approval status and access changes. These come from you, our sign-in service or an authorised administrator.
- Startup research: ideas, budget range, available time, skills, location, target customers, constraints, reports, plans, tasks and evidence notes you submit or save.
- Business workspaces: business profiles, reports and images submitted for extraction, financial figures, short source excerpts, corrections, import history, people and roles, business decisions, action plans, sales opportunities and dated research/review snapshots. These come from you, authorised colleagues, connections you enable and requested research.
- Public information: company identities, accounts and officers from Companies House; business websites, public role information, company announcements and relevant publications. Public availability does not remove people’s privacy rights. Public officers or website-listed people are not assumed to be a confirmed employee roster.
- Enquiries: support messages, replies, pilot applications, business contact details, assessment and follow-up notes. Pilot applications are separate from signed-in workspace records; an application email is not treated as a verified account.
- Purchases: order and payment references, amounts, payment status, credit use and accepted terms version. Stripe handles card entry; do not put card details in your workspace.
- Operations: request and error metadata, security and access records, and account-linked AI feature, model, token/usage and cost records. Our cost meter does not store prompts or reports. Hosting and authentication providers may separately process IP addresses, device/request information and operational logs.
- Optional measurement: only if enabled, fixed product activity names, account ID and dates. These application measurement records do not contain your idea text, report content, IP address, referrer or device fingerprint.
Why we use information
| Purpose | Basis |
|---|---|
| Provide an individual’s account and purchased service; respond to a requested pre-contract enquiry | Performance of a contract or steps requested before a contract |
| Administer company contacts, invitations and business relationships | Legitimate interests in delivering and managing the requested business service |
| Protect accounts, prevent abuse and fraud, investigate failures, measure service costs and handle disputes | Legitimate interests in a secure, reliable service and proportionate business administration |
| Keep legally required financial records and respond to lawful requirements | Legal obligation |
| Optional product-usage measurement | Consent, which can be withdrawn in Data & preferences |
Where we rely on legitimate interests, we consider necessity, reasonable expectations and the effect on people’s rights. A contract with a company is not automatically a contract with each employee. Processing on a business customer’s instructions follows its lawful purposes and our DPA.
A verified email is needed to sign in; without it we cannot provide a saved account. Requested service information is needed to perform the relevant research. Optional measurement and marketing are not conditions of access. An enquiry or accepting a privacy notice does not subscribe you to marketing.
AI research, extraction and human review
Relevant submitted information is sent to OpenAI’s API when you request extraction, research or analysis. Business reviews may also update after an import, a relevant saved change or an enabled scheduled source refresh. Review the controls in Sources & connections. Ordinary navigation does not by itself commission a new review.
Business public-search requests use company names, websites, sector, market/location details and relevant publicly filed accounts. Private documents and financial inputs are used for extraction and private analysis, rather than as public web-search queries. Startup research uses the ideas and context you submit, so avoid including secrets or unnecessary personal information in those fields.
AI output can be inaccurate or incomplete. It supports human decisions; it is not an independent audit or a solely automated decision by us that has legal or similarly significant effects on you. Check sources and correct inaccurate records.
We do not train a shared model ourselves using your workspace content. OpenAI states that API data is not used for model training by default unless data sharing is enabled. Our application requests use store:false where supported; this does not eliminate provider abuse-monitoring or other feature-specific retention. We do not promise zero provider retention. See the provider information.
Recipients and international processing
We use Vercel for application hosting/execution, Neon for the database and sign-in, OpenAI for AI processing and Stripe where payments are used. Authorised personnel and professional advisers may access information where needed for support, security, administration or legal obligations. An accounting provider receives connection requests when you choose to connect it. We may disclose information where required by law or to protect legal rights. We do not sell workspace information.
Processing and remote support can occur outside the UK, including in the EEA and United States; this is not a UK-only service. Providers publish their regional and onward-processing information in the service-provider directory. A London hosting region does not mean all logs, AI processing, support and backups stay in the UK.
Restricted transfers require a lawful mechanism. Provider terms include UK transfer provisions, such as the UK Addendum or IDTA with standard contractual clauses, and adequacy arrangements where applicable. The mechanism must cover the actual recipient and service. Contact support@brighterdesk.com for the arrangements applicable to your service and a copy of relevant safeguards, with commercial or security details redacted where necessary. A location-specific requirement must be agreed before uploading; no particular residency or special retention arrangement is implied.
Retention and deletion
| Record | Retention or decision criteria |
|---|---|
| Saved projects, business evidence, plans and support requests | Kept to provide the saved workspace until removed through the relevant controls or an authorised deletion request. We assess continued need when an account or service ends. |
| Original financial uploads | Temporarily stored for background extraction; removed after successful extraction. Failed-job originals are eligible for cleanup after 24 hours at the next daily cleanup. Extracted figures and excerpts remain separately. |
| Optional usage records | Older than 90 days: excluded and pruned at the next collection/summary request. Switching measurement off removes that account’s existing measurement records from the active database. |
| Pilot enquiries and follow-up | Kept while assessing the application and managing the related follow-up or pilot. Retention after that depends on a continuing relationship, a specific dispute or legal need. These records are not removed by a workspace reset; request their deletion separately. |
| Purchases, invoices and credit ledger | Retained separately for delivery, refunds, disputes and applicable accounting/tax requirements. Applicable statutory record periods, open disputes and unused credits determine the necessary period. |
| Identity, access, cost and security records | Kept separately while needed for account operation, charge reconciliation, access accountability and investigation. Account closure and privacy requests require review of these records, not just workspace content. |
| Deletion-control records | A minimal identifier/version record prevents unfinished operations restoring deleted content. It is not a retained copy of the deleted report. |
| Provider logs and backups | Separate provider retention and expiry apply. Deleting active data does not instantly remove all provider backups or logs. Ask for the relevant provider information before agreeing a specific deletion deadline. |
A disconnected accounting connection stops new retrieval and removes our stored credentials; previously imported figures remain until removed. Removing an import record does not automatically erase confirmed figures or earlier assessment snapshots. Workspace reset does not close the sign-in account or erase purchase records. Keep your own original financial records and exports.
Where no fixed period is stated, retention is assessed against the original purpose, service/account status, sensitivity, unresolved disputes and legal requirements. These criteria do not authorise indefinite retention for a possible future use.
Your choices and rights
Use Data & preferences to export application data, change optional measurement and review workspace deletion. For account closure, pilot-application records or a broader request, email support@brighterdesk.com. We may need proportionate identity and authority checks. If your organisation controls the information, we will help direct the request to it and assist on its instructions.
- Depending on the circumstances, you can request access, correction, erasure, restriction and portability.
- You can object to processing based on legitimate interests and to direct marketing.
- You can withdraw consent at any time without affecting earlier lawful processing.
- You can complain to the Information Commissioner’s Office. You do not have to complain to us first.
We normally respond to rights requests within one month, subject to any lawful extension or permitted clarification/identity process. Some rights are qualified, for example where records must be retained by law. We explain any refusal or restriction.
Device storage and changes
Read our Cookies & device storage notice. We date revisions here and will communicate significant new uses appropriately before they take effect, seeking fresh consent where required. This notice explains processing; it is not a blanket consent to use information for anything we choose.
Questions about this document? support@brighterdesk.com